- cypherpunks-legacy - lists.cpunks.org

Security flaw in Microsft Explorer
by Gary Howland 17 Dec '03

17 Dec '03

Program compromises IE security By Nick Wingfield September 23, 1996, 10:45 a.m. PT A start-up Internet company has posted a program on the Net that could allow Web sites to bypass the security controls in Internet Explorer, CNET has learned. The company, InfoSpace, created a program aimed at Net search engines such as Lycos and Excite that want to become the default search engine in Microsoft's Internet Explorer 3.0. But the program, which is actually featured on the Lycos Web site, manages to circumvent Explorer's security warning window--an action that could let InfoSpace sneak programs onto a user's personal computer without warning. Although the InfoSpace program apparently was not created with malicious intent, it underscores the fragility of Internet Explorer's security defenses, as well as broader security issues related to downloading software over the Internet. The InfoSpace program sidesteps a security feature in Internet Explorer, called Authenticode, which is designed to allow users to verify the origins of a piece of software code, such as an ActiveX control, a script, or a plug-in. The Authenticode system requires a user to entrust the developer of a program, whether it's InfoSpace, Lotus Development, or IBM, not to install viruses or other destructive programs on the user's system. Although Authenticode does not prevent software developers from creating such programs, they can be held legally accountable for bad code. That's because the programs contain "digital signatures," a sort of ID card that allows perpetrators to be tracked down by law enforcement agencies. Microsoft works with VeriSign to provide digital signatures for programs. Last month, VeriSign took matters into its own hands by asking a developer, Fred McLain, to remove an ActiveX control called Exploder from his Web site. The Exploder control was designed to crash a user's computer after downloading. "Code signing is not a guarantee of code quality," Charles Fitzgerald, a product manager at Microsoft said. "It's an accountability trail." As with all digitally signed programs, users are offered the option to accept or to reject the InfoSpace program before installing it on their systems. Users are also offered the option to bypass the Authenticode warning window for all InfoSpace programs in the future. But the company's program registers InfoSpace as a "trusted publisher" in Explorer, effectively opening the browser to intrusions. The operation is akin to inviting a guest over to your house for dinner and having them copy the key to your front door without permission. InfoSpace executives denied that there was any malice intended in its program, adding that it has provided Lycos with an updated version of the code. Lycos plans to post the new program later this evening, according to InfoSpace. "It was a bug that got incorporated into the production code," InfoSpace CEO Naveen Jain said. Lycos CEO Bob Davis said he was not aware of the bug in the InfoSpace program and could not comment on it. The program is identified as Lycos Quick Search on the search engine's site. However, Microsoft officials expressed concern, saying it is hard to defend against once a user has consented to download code from the Net. "Clearly their software is doing something a tad aggressive," said Rob Price, a group program manager for Internet security at Microsoft."[With Authenticode], users are making a one-time trust decision, this is a persistent trust decision." Microsoft argued that Explorer provides better security than Netscape Communications' Navigator, which does not currently allow digital signatures on plug-ins. In Explorer, users are warned before downloading code even if the program does not contain a digital signature, though the source of the program is not identified. In contrast to plug-in software and ActiveX controls, Java applets are prevented from damaging a user's computer through built-in restrictions in the Java Virtual Machine. "Java is the model for dynamic executable content on the Net," said Eric Greenberg, group security manager at Netscape.

1 0

Re: AP [NOISE]
by jim bell 17 Dec '03

17 Dec '03

At 10:10 PM 9/23/96 -0400, hallam(a)vesuvius.ai.mit.edu wrote: > >Jim, > > I do support the presence of troops in Northern Ireland and >do not consider that to contradict my belief that there should be a >united, autonamous Ireland. I do not believe that the "loyalists" are >in fact loyal to the British way of life, any more than the KKK are >representative of the US south. > > Troops are in Northern Ireland for a very simple and depressing >reason. People like Jim want to impose their will on others by force. Quite the contrary. I want to reduce, as much as possible, the ability of people to impose their will on others by force. Read my essay. Eventually you might figure it out. The difference is, I recognize that if you set up a government to try to minimize non-government violence and coercion, you'll get just that: A minimization of NON-GOVERNMENT violence and coercion, at the expense of vastly increasing the GOVERNMENT kind. And I don't consider that progress at all. >Despite prolonged attempts by each faction to assasinate the leaders of >the other they have been unsuccessful. I suppose it didn't occur to you that this is EXACTLY why this dispute has gone on so long? What if instead of being "unsuccessful," these attempts suddenly became 100% successful. Easy, even. Just push a button and the top guy on the other side dies. And you could do this as often as, say, once an hour, with all of his replacements. And the other side can do the same to your leadership. How long do you think it would be before people decide that maybe, they DON'T want to "step up to the plate" and get killed for the sake of their cause? >If terrorists trained by Lybia >and Syria are unable to assasinate at will then we can be sure thaqt Jim's >band of kooks is not going to get any further. Which means that you clearly don't understand the motivating factor of a large, totally anonymous e-cash payment. And why should a handful of "terrorists" be successful? The "AP gang" will consist of 5 BILLION people who want to collect the reward, including anyone close to the target. It'll put an entirely new, ominous meaning into the phrase, "Friends and Family"! B^) >If the integration of both Irealand and the UK into the European >Union has not ended the situation the complete lack of government >will not either. Hell, the whole reason for this dispute is heirarchical social systems, in this case governments and religions! And adding the European Union merely increases the problem by adding to the heirarchy. My solution eliminates the heirarchy, totally. Why, then, should EU's failure imply a failure by AP? It's the diametrically opposite tactic. > It is suprising that someone from the press has not seized upon Jims >ideas as cause for another cyber-scare. I suspect this is because people >like Markof are somewhat more responsible. No, it's probably because they think, nervously, that I might just be right. Even that won't necessarily want to make them want to associate their names with my ideas. If they truly understand them, they'll recognize that it'll happen regardless of the amount of approval it gets from polite society. >This is not going to stop me >from producing an op-ed piece linkiing the net libertarians to assasination >politics unless I hear a few more repudiations of Bell's ideas. A doubt whether most people feel themselves obligated to repudiate a proposal, particularly if they don't know that it won't constitute an improvement over the status quo. On the other hand, if the world engineers a good, permanent solution to the Northern Ireland problem in the next six months, as well as the Middle East problem, the India/Pakistan problem, the Chechnya problem, the North/South Korea problem and a few other heretofore intractable problems, you can start feeling confident that my "extreme" solution will be avoidable. Until then, don't get your hopes up. >If you >don't very clearly reject his murderous ideas you are going to regret it >just as the left regreted having the USSR or the RAF associated with them. > Phill Time will be the best judge of this, I think. Jim Bell jimbell(a)pacifier.com

1 0

Factoring technique, faster than trial division?
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

just an idea I came up with today, I don`t suggest it is a fast factoring method, but it would be interesting to know if it is faster than say trial division: Calcuate a composite number H such that H has a large number of prime factors (hundreds). now use the euclidean algorithm to try to find a gcd of X (the number being factored) and H, if there is none try a new H, if there is you have found a factor. It is hardly elegant but I would nevertheless be interested to see if it is apreciably faster than other kludge methods like trial division. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

1 0

Re: We removed radikal 154 from xs4all :(
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:22 PM 9/23/96, sameer(a)c2.net wrote: >> Unfortunately, this means that Germany wins. > > How does this mean that Germany wins? "radikal 154" is still >available all over the world, at almost 50 mirror sites, I beleive >(including http://www.c2.net/radikal/) which are *not* blocked by >Germany. Germany went after the most visible site, the _original_ site. That other sites were mirroring the verboten material did not stop them from blocking access to xs4all, so Germany clearly still wanted to make an example of xs4all. That xs4all eventually capitulated has to be seen as a win for Germany. (Certainly within the government of Germany, they must be viewing this as a victory.) They will probably now turn their sights on other sites (no pun intended), hoping to pick off each one in turn. I guess it's the domino theory all over again. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: We removed radikal 154 from xs4all :(
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:46 PM 9/23/96, Mike McNally wrote: >place. While the Germans are off blocking other sites, xs4all can >re-host the material as soon as the Bundesfeds unblock their ^^^^^^^^^^ Beavis and Bundesfed? --Tim We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

We removed radikal 154 from xs4all :(
by tank 17 Dec '03

17 Dec '03

Hi all, We have temporary removed radikal 154 from xs4all. We did this because the german ICTF and BAW continued to stop IP-traffic to and from xs4all. They not only blocked the web-server (with more than 3100 homepages from users and compagnies) but 2 Class C-networks. The pressure was to high for both xs4all and it costumers (more than 12500 users). They were not able to mail, ftp, www in large parts of germany. The 47 mirrors of the radikal site made it possible for us to remove issue 154 from xs4all. All 47 mirrors are still accessable by german netizens. There is no filtering of traffic to these servers. The ICTF and BAW now have to deceide if they will block all ip-traffic to and from all 47 servers, or they have to stop their censoring actions. In both cases we will put the issue radikal 154 back online. We are still calling for more mirrors. The more mirrors, the more pressure on the ICTF and BAW to stop their censorship. You can get a copy of the who archive from ftp://utopia.hacktic.nl/pub/replay/pub/incoming or from one of the mirror-sites. regards, henk (SPG)

1 0

Re: More proposals for European censorship
by Asgaard 17 Dec '03

17 Dec '03

On Mon, 23 Sep 1996, Peter Trei wrote: > > It's probably no coincidence that the recently busted, utter horrible > > child-molesting ring, with obvious protection from various persons > > in the establishment, was centered in Belgium - that's where the EU > > bureaucrat nomenklatura play their power games and go to bordellos. > What exactly are you suggesting when you say 'it's probably no > coincidence?" I can't quite figure it out. Obviously not only the arrested killer used the schoolgirls chained in underground cells. They were for hire. High officials used his 'services', then ordered the police to cover it up. Why else would some ten policemen be arrested? The EU bureaucrats are served by hordes of prostitutes. Surely there are pedophiles among the hordes. Probably some EU pedophiles have a connection to the gang. I don't know this of course, but speculation is cheap. Asgaard

2 1

Re: U.S. in violation of Geneva convention?
by Anonymous Sender 17 Dec '03

17 Dec '03

Harmon Seaver wrote: > > This isn't a ski mask burglary. We KNOW Saddam ruled Iraq. > > We KNOW what crimes were committed. Simple syllogism. > > No we don't. We only know what the propaganda mills have told us. > Twenty years ago it was a different story. The propaganda mills were working for Saddam, not against him. http://www.indybay.org/news/2003/04/1599076.php "Over the last dozen years I made 13 trips to Baghdad to lobby the government to keep CNN's Baghdad bureau open and to arrange interviews with Iraqi leaders. Each time I visited, I became more distressed by what I saw and heard - awful things that could not be reported because doing so would have jeopardized the lives of Iraqis, particularly those on our Baghdad staff." http://www.techcentralstation.com/041103H.html "It appears there is another, more troubling, reason Jordan decided not to report these hideous crimes until the regime was safely out of the way: CNN didn't want to lose its on-the-ground access to a big story." Human Rights Watch, Amnesty, and countless Iraqi refugees all report similar stories of widespread torture and murder. Is it your position that these are all propagandists? Dismissing as "propaganda" any reports that oppose your argument, while accepting as truth any claim that supports it, is simple intellectual dishonesty.

1 0

U.S. in violation of Geneva convention?
by James A. Donald 17 Dec '03

17 Dec '03

-- On 16 Dec 2003 at 2:36, Anonymous wrote: > I saw several people commenting the issue of Geneva > convention on CNN during the day. Also I saw an expert on > this field from another country commenting on the issue > stating that it was a clear violation of the convention. In > either of these interviews were there any discussion on > whether it didn't apply to this specific case due to what > clothings he happened to wear or whattever. I got the > impression that it was clear that the U.S. treatment wasn't > fully appropriate. If you were watching the BBC, you would have thought most of the Iraqi population were outraged by his capture. I think you are suffering from New York Times syndrome "If even the New York Times admits that the kulaks are happy and prosperous under Stalin, that shows you how great the Soviet Union really must be when you discount all that capitalist propaganda." --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG Lh9C/c3J2U0bybWlK/P0f5hnnZT1z+2QEe1K9Ev2 4cVVWOLkCVsvYQG/u75vRB5xVrL2GjBeaEl+j6x07

6 6

Re: Sunny Guantanamo (Re: Speaking of the Geneva convention)
by Michael Kalus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 17-Dec-03, at 5:43 PM, Jim Dixon wrote: > >> According to the US Government though they are not soldiers. They are >> "unlawful enemy combattants". > > I can only interpret this as your saying that the US Government's > judgement in this issue is correct, and they are not POWs. > I only tell you what they are telling us. I do not agree with this assessment personally. >> >> The war in Afghanistan is over. This is were they were caught. Thus >> they >> should be released, no? > > Oh, we are back to their being POWs. Fine. In that case, the answer > to > your question is no. > > The war in question was begun by an attack on the United States, by the > murder of 3000 people in New York City. Is this war over? Not > according > to tapes attributed to al Qaeda. They still profess to be at war with > the United States. > Where the war begun is probably debatable. The US had (and has) their fingerprints over a lot of things that are happening. And all of these you could construe as an act of war. > Is the war in Afghanistan over? Not according to news reports. Osama > bin > Laden remains free. The Taliban remain active. But the regime has been replaced, thus the war is over, no? That was the case in Europe. Germany was defeated, a new government installed (with a lot of people from the old one) and you called it "done deal". Same in Japan. So what's different this time? > >> If they are terrorists and they have proof of >> this they should put them in front of a court (and I guess that should >> be a civil court, not a military tribunal as I don't quite see since >> when the US Army is performing law enforcement duties). > > Please make your mind up. Now they are terrorists again. > I am answering to your statements. We have already established that if they are POWs then they should be released because the war is over (see above). If they are not POWs but held because of terrorist charges, than they should be tried no? > Whose law requires that terrorists be treated in this fashion? > Our "enlightened" western society, led by the USofA who proclaims to know what right and wrong is (and who wants to teach it to all those "primitive" cultures in the middle east). > The US Army's responsibility is not to enforce the law. It is to > defend > the United States. They seem to be doing a good job at the moment. > Sure sure, nobody has flown another plane in a building. Is this because of the US Army and all those nifty security screenings at the airport (just last weekend I flew out of Dallas and saw more than enough ways to get something through security), or because nobody really wanted to do it right now? Guess we'll never know. But of course the Spinmeisters are going to say it's because of the war in Iraq and added security. I wonder who or what they are going to blame the next time someone gets blown up. > In the United States it is the responsibility of the police to enforce > the > law in their jurisdiction. There is no US police force with > responsiblities in Guantanamo. US law does not apply to Cuba. Nifty, isn't it? "Well people, we see your point. But you have to Understanding, even though we control Guantanamo Bay and even though Diego Garcia is a British Island which we just annexed, we can't really do anything to help those poor people. But don't fret, if they would be in an Afghani jail they would be off worse. Remember, we are the good guys, we only do what's in humanities best interrest." If they would be held in New York State they would have more rights. So let's just not even try that, we might actually HAVE to treat them according to the gospel that we preach. >> But they are not POWs by their own account. If they could be charged >> with any of these crimes above, then what takes two years to actually >> convict them? > > By your way of thinking, if I am taken prisoner in a war, I can decide > that I am not a POW and walk free. That's not what I said. What I DID say was that if they are not POWs and are not charged with a crime, they should be set free. > > In what war has this been common practice? See above. >> Some of them ARE US Citizens. Others are citizens of other states. >> International Law means that if I (holding a German passport) have to >> be >> allowed to contact MY government in order to receive any aid that I >> might require. This right has not been given. > > What "International Law" says that unlawful combatants get to contact > their governments in this manner? > The term "unlawful combatants" doesn't exist either. So the question is mute. Let's say "Human being" instead. > What if the government contacted, say Afghan or Pakistani, would prefer > that they not be contacted as you desire, or prefers that you be held > as > a prisoner indefinitely? Than you have a problem with your government. But neither British, nor Canadian nor French authorities were notified / could be contact OR, after they found out, were allowed to talk to their people. > >> Granted, I would not be protected under the rights of the US >> constitution, but I do have other rights and those are clearly >> violated >> as well. > > What's so clear about this? Do you actually have any knowledge at all > of customs and practices in countries in the region? Do you care at > all > about the opinions of local people, about their customary practices? I > think not. It is not only about people from Afghanistan, it is also about other countries, see my text above. >> >> Treason would need to be proofen. Considering that no charges have >> been >> brought forward after almost two years it is pretty clear (or at least >> appears to be) that there is no proof that any of these people did >> anything wrong. > > Do you know for a fact that there are US citizens held at Guantanamo? > If > so, who are they? > There have been several reports. What about John Walker? Whatever happened to him? >>> >> It doesn't. But if that would be the case than the captured Afghans >> should be returned to the Afghan authorities, why is this not >> happening? > > Perhaps the Afghan authorities don't want them back. > > Hello? > Perhaps you just look for the easy way out? Michael -----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3 iQA/AwUBP+DwTmlCnxcrW2uuEQL6iwCeOK5U56u8xVB9aT1SAqj+yi7OULcAoOd0 bml/UV9L7YtJFFoAq77OCilk =aXZZ -----END PGP SIGNATURE-----

1 0